Two-Factor Authentication for File System Data Objects
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current file system security measures are inadequate as a single authentication factor is insufficient to prevent malicious programs, such as malware, from performing unauthorized operations on data objects, compromising the integrity of the file system.
Innovation Solution
Implementing a two-factor authentication system where the file system requires a second authentication factor for specific operations, such as deleting or modifying data objects, which involves generating a notification that includes the second authentication factor and receiving a response within a specified timing schedule from an administrator system to confirm the operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single authentication factor is used for file system access, then ease of operation is improved, but security is worsened allowing malware to perform unauthorized operations
Solution Approach 1:
The authentication process is segmented into multiple independent factors: the first authentication factor (username/password) and the second authentication factor (notification approval). Each factor provides a separate layer of security, so that compromising one factor does not grant full access. The system divides the authentication mechanism into distinct components that must both be satisfied for authorized access.
2Reliability
If a two-factor authentication system is implemented, then security is improved, but device complexity is worsened
Solution Approach 1:
The system introduces an intermediary notification mechanism that mediates between the client system and the file system. When a sensitive operation is requested, the intermediary sends a notification to the client for approval. This intermediary layer manages the complexity of two-factor authentication by providing a standardized interface for requesting and verifying the second authentication factor, without requiring complex changes to the underlying file system or client systems.
3Object-affected harmful factors
If a second authentication factor is required for sensitive operations, then harmful factors are reduced, but loss of time is worsened due to additional authentication steps
Solution Approach 1:
The system performs preliminary actions by establishing the first authentication factor in advance during the initial login process. When sensitive operations are later requested, the system leverages this pre-established authentication context and only requires the second factor for specific high-risk operations. This preliminary authentication reduces the overall time burden, as the first factor is already verified and the second factor is only prompted when necessary, not for every operation.
Data Source
AI summary
A first authentication factor associated with a client system may be received. An input may be received from the client system that corresponds to an operation to be performed on a data object. A processing device may determine whether the operation is one of a set of operations being associated with a second authentication factor. In response to determining that the operation is one of the set of operations being associated with the second authentication factor, the processing device may generate a notification for the second authentication factor. A response including the second authentication factor may be received and the operation may be performed in view of the second authentication factor.